CVE-2026-68367 Linux CVE debrief

Who should care

Linux kernel developers, Linux distribution maintainers, and organizations using Linux with USB gadget support should review and apply updates or mitigations. They should also monitor for unusual activity or errors related to USB gadget functions and implement compensating controls such as restricting access to USB devices. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Vulnerability management teams should prioritize patching based on exposure and asset inventory reviews. Monitoring and detection teams should check relevant logs for exposed assets that need extra review. Asset inventory managers should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Change management teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Source tracking should be implemented to verify affected scope and severity. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Rollback/change windows should be considered for timely remediation. Security teams should verify and update affected Linux distributions. They should also implement compensating controls for exposed systems while remediation is scheduled and verified. Monitoring and detection teams should check relevant logs for exposed assets that need extra review. Asset inventory managers should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Change management teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Source tracking should be implemented to verify affected scope and severity. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Rollback/change windows should be considered for timely remediation. Security teams should verify and update affected Linux distributions. They should also implement compensating controls for exposed systems while remediation is scheduled and verified. Monitoring and teams

Technical summary

The f_tcm set_alt() path in the Linux kernel defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses f_tcm private state and may complete the setup request after disconnect or function teardown has already moved on. To fix this, the delayed set_alt work is cancelled and drained when the function is unbound or freed. The fix also serializes the final delayed-status completion with the cancellation check while holding the composite device lock.

Defensive priority

High

Recommended defensive actions

• Inventory and assess Linux kernel configurations for USB gadget support
• Apply kernel updates or patches addressing this vulnerability
• Monitor for unusual activity or errors related to USB gadget functions
• Implement compensating controls such as restricting access to USB devices
• Verify and update affected Linux distributions

Evidence notes

The vulnerability was reported via a KASAN (Kernel Address Sanitizer) error report showing a slab-use-after-free in tcm_delayed_set_alt. The error occurred when the delayed work accessed memory that had already been freed. The report included a call trace and memory allocation and deallocation information. Defenders should verify affected Linux kernel configurations for USB gadget support and review compensating controls for exposed systems.

Official resources